24小时有人试探路由器SSH，1秒1次，系统日志全部是这些信息

68336016

OPENWRT系统，已经关闭了远程SSH，估计也试探不出来什么，就是系统日志很不好看，全部都是这些信息，隔1秒就1次。


Apr 24 09:26:41 OpenWrt authpriv.info dropbear[1441]: Child connection from 222.171.12.107:55842
Apr 24 09:26:42 OpenWrt authpriv.warn dropbear[1441]: Login attempt for nonexistent user from 222.171.12.107:55842
Apr 24 09:26:43 OpenWrt authpriv.info dropbear[1441]: Exit before auth: Disconnect received
Apr 24 09:26:43 OpenWrt authpriv.info dropbear[1442]: Child connection from 222.171.12.107:56781
Apr 24 09:26:44 OpenWrt authpriv.info dropbear[1442]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:26:44 OpenWrt authpriv.info dropbear[1443]: Child connection from 222.171.12.107:57491
Apr 24 09:26:45 OpenWrt authpriv.info dropbear[1443]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:26:45 OpenWrt authpriv.info dropbear[1444]: Child connection from 222.171.12.107:58223
Apr 24 09:26:47 OpenWrt authpriv.info dropbear[1444]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:26:47 OpenWrt authpriv.info dropbear[1445]: Child connection from 222.171.12.107:59028
Apr 24 09:26:48 OpenWrt authpriv.warn dropbear[1445]: Login attempt for nonexistent user from 222.171.12.107:59028
Apr 24 09:26:48 OpenWrt authpriv.info dropbear[1445]: Exit before auth: Disconnect received
Apr 24 09:26:48 OpenWrt authpriv.info dropbear[1446]: Child connection from 222.171.12.107:59934
Apr 24 09:26:50 OpenWrt authpriv.info dropbear[1446]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:26:50 OpenWrt authpriv.info dropbear[1447]: Child connection from 222.171.12.107:60795
Apr 24 09:26:51 OpenWrt authpriv.info dropbear[1447]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:26:51 OpenWrt authpriv.info dropbear[1448]: Child connection from 222.171.12.107:33267
Apr 24 09:26:52 OpenWrt authpriv.info dropbear[1448]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:26:52 OpenWrt authpriv.info dropbear[1449]: Child connection from 222.171.12.107:34024
Apr 24 09:26:54 OpenWrt authpriv.info dropbear[1449]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:26:54 OpenWrt authpriv.info dropbear[1450]: Child connection from 222.171.12.107:34719
Apr 24 09:26:55 OpenWrt authpriv.info dropbear[1450]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:26:55 OpenWrt authpriv.info dropbear[1451]: Child connection from 222.171.12.107:35563
Apr 24 09:26:56 OpenWrt authpriv.info dropbear[1451]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:26:56 OpenWrt authpriv.info dropbear[1452]: Child connection from 222.171.12.107:36254
Apr 24 09:26:58 OpenWrt authpriv.info dropbear[1452]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:26:58 OpenWrt authpriv.info dropbear[1453]: Child connection from 222.171.12.107:37031
Apr 24 09:26:59 OpenWrt authpriv.info dropbear[1453]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:26:59 OpenWrt authpriv.info dropbear[1454]: Child connection from 222.171.12.107:37743
Apr 24 09:27:00 OpenWrt authpriv.info dropbear[1454]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:27:00 OpenWrt authpriv.info dropbear[1455]: Child connection from 222.171.12.107:38416
Apr 24 09:27:02 OpenWrt authpriv.info dropbear[1455]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:27:05 OpenWrt authpriv.info dropbear[1456]: Child connection from 222.171.12.107:39139
Apr 24 09:27:06 OpenWrt authpriv.info dropbear[1456]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:27:06 OpenWrt authpriv.info dropbear[1457]: Child connection from 222.171.12.107:41428
Apr 24 09:27:07 OpenWrt authpriv.info dropbear[1457]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:27:07 OpenWrt authpriv.info dropbear[1458]: Child connection from 222.171.12.107:42249
Apr 24 09:27:09 OpenWrt authpriv.info dropbear[1458]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:27:09 OpenWrt authpriv.info dropbear[1459]: Child connection from 222.171.12.107:43030
Apr 24 09:27:10 OpenWrt authpriv.warn dropbear[1459]: Login attempt for nonexistent user from 222.171.12.107:43030
Apr 24 09:27:10 OpenWrt authpriv.info dropbear[1459]: Exit before auth: Disconnect received
Apr 24 09:27:10 OpenWrt authpriv.info dropbear[1460]: Child connection from 222.171.12.107:43962
Apr 24 09:27:12 OpenWrt authpriv.info dropbear[1460]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:27:12 OpenWrt authpriv.info dropbear[1461]: Child connection from 222.171.12.107:44748
Apr 24 09:27:13 OpenWrt authpriv.info dropbear[1461]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:27:13 OpenWrt authpriv.info dropbear[1462]: Child connection from 222.171.12.107:45497
Apr 24 09:27:14 OpenWrt authpriv.warn dropbear[1462]: Login attempt for nonexistent user from 222.171.12.107:45497
Apr 24 09:27:15 OpenWrt authpriv.info dropbear[1462]: Exit before auth: Disconnect received
Apr 24 09:27:15 OpenWrt authpriv.info dropbear[1463]: Child connection from 222.171.12.107:46281
Apr 24 09:27:16 OpenWrt authpriv.info dropbear[1463]: Exit before auth (user 'root', 1 fails): Disconnect received
Apr 24 09:27:25 OpenWrt authpriv.info dropbear[1464]: Child connection from 222.171.12.107:46793
Apr 24 09:27:26 OpenWrt authpriv.info dropbear[1464]: Exit before auth: Exited normally

cmheia

防火墙开起啊

68336016

cmheia 发表于 2014-4-24 10:53
防火墙开起啊

已经是开启的，就是不知道要设置什么规则才能避免这一堆提示

wye11083

cmheia 发表于 2014-4-24 10:53
防火墙开起啊

既然开了SSH，肯定不能防火墙。看上去是有人在试探SSH用户名和密码。

cmheia

wye11083 发表于 2014-4-24 11:17
既然开了SSH，肯定不能防火墙。看上去是有人在试探SSH用户名和密码。

谁说ssh就不能防火墙

bigfatfish

换个端口最省事
这种一般都是广撒网，弱密码碰到一个算一个
端口号不是22的话，他们都没兴趣详细扫描

xuanfong1

防火墙开机  绑定可连接设备的mac